8.7
High
CVE-2025-11393 A flaw was found in runtimes-inventory-rhel8-operator
Description
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1.0 | earliest → < 1.0.0-1765483112 | 1.0.0-1765483112 |
| Red Hat Runtimes Inventory Operator | Versions not published | |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1 1.0 | earliest → < 1.0.0-1765483112 | 1.0.0-1765483112 |
References
- RHSA-2025:23236 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2402032 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
The 11 CVEs of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 →
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium
CVE-2026-39821
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
9.6
Critical
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
High
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…
7.5
High